SUSPICIOUS — 5e616607ed.pdf
SUSPICIOUS — 5e616607ed.pdf is a pdf sample analyzed by MalwareAnalyzer by Cyble with a suspicious verdict (44/100). 2 of 50 detection engines flagged it.
Identification
- SHA-256:
b84aaea20c56c8cd6fd5ff5e58c516402e4aa72ea73e99aaf8883d960d7805e1 - SHA-1:
161aa98e6529c664b8409a0ead9a74d1a5fa3c2a - MD5:
b88e417f4c975c90d3fb720300a29849 - ssdeep:
768:9gGzpDIpNFXZumxfe0mZbL6sMZwP5NCVgQNTiY5b0GP7GNTQTc3AcL43stQXerOn:+GFkpJdF0y7DuL43Wq25/XE - TLSH:
T136328DF320D7ED0CBA8B9B27ACA71165148DC3896237D7A005CC676CD8AC6BD2F51960 - Submitted as: 5e616607ed.pdf
- File type: pdf · Size: 43558 bytes
- Verdict: suspicious (44/100)
Detections (2 of 50 engines)
- MalwareAnalyser heuristics (entropy/packer): high-entropy-blob
- Emsisoft (Emergency Kit): PDF.Spam.Heur.1
Why this verdict
The suspicious score of 44/100 is the fusion of 3 weighted signals:
- Embedded network infrastructure: https://gettraff.ru/wb?keyword=p226%20legion%20manual, https://cdn-cms.f-static.net/uploads/4376372/normal_5f8c92e03f32c.pdf, https://cdn-cms.f-static.net/uploads/4366010/normal_5f86f5d59d3e4.pdf - static signal, weight 0.35, confidence 0.60
- Document active content: uri-action - static signal, weight 0.30, confidence 0.60
- Packing/obfuscation: high-entropy-blob - static signal, weight 0.25, confidence 0.55
Dynamic analysis
No runtime behaviour was captured for this sample, so the analysis above is static only. That is a limit of this run rather than evidence the sample does nothing.
Embedded URLs
- https://gettraff.ru/wb?keyword=p226%20legion%20manual
- https://cdn-cms.f-static.net/uploads/4376372/normal_5f8c92e03f32c.pdf
- https://cdn-cms.f-static.net/uploads/4366010/normal_5f86f5d59d3e4.pdf
- https://cdn-cms.f-static.net/uploads/4365624/normal_5f890c1f274d8.pdf
- https://cdn-cms.f-static.net/uploads/4367312/normal_5f891b46927fa.pdf
- https://cdn-cms.f-static.net/uploads/4367916/normal_5f875f47e1254.pdf
- https://uploads.strikinglycdn.com/files/47c51097-d0fd-4615-bca2-d74e7e52ddd2/lurukarususumi.pdf
- https://uploads.strikinglycdn.com/files/42855502-85d2-4d32-9284-f41375c332fb/95350830603.pdf
- https://uploads.strikinglycdn.com/files/36314caf-33df-4be8-bd54-7b09e0129f9d/vuluderovifafotarir.pdf
- https://uploads.strikinglycdn.com/files/9d809d39-8f36-4bee-bc6e-bda41cec8f6c/apariencia_vs_realidad_macbeth_entie.pdf
- https://cdn-cms.f-static.net/uploads/4370299/normal_5f8d8b63bd28c.pdf
- https://cdn-cms.f-static.net/uploads/4366000/normal_5f872cdd359d9.pdf
- https://cdn-cms.f-static.net/uploads/4366000/normal_5f8932f27a9e3.pdf
- https://cdn-cms.f-static.net/uploads/4373768/normal_5f8e2d6c2f5a0.pdf
- https://cdn-cms.f-static.net/uploads/4365562/normal_5f8712333b3f8.pdf
- https://cdn-cms.f-static.net/uploads/4368745/normal_5f88ce11a18f7.pdf
- https://cdn-cms.f-static.net/uploads/4386349/normal_5f8d514a20646.pdf
- https://cdn-cms.f-static.net/uploads/4373505/normal_5f8a228179251.pdf
- https://cdn-cms.f-static.net/uploads/4368762/normal_5f87a4f98a915.pdf
- https://cdn-cms.f-static.net/uploads/4379842/normal_5f8ac8496112f.pdf
- https://cdn-cms.f-static.net/uploads/4373261/normal_5f8de4f6f3265.pdf
- https://cdn-cms.f-static.net/uploads/4381098/normal_5f8bb45197646.pdf
- https://cdn-cms.f-static.net/uploads/4380871/normal_5f8e440eb2f2f.pdf
- https://cdn.shopify.com/s/files/1/0479/6560/1959/files/veteran_badge_roblox_catalog.pdf
- https://cdn.shopify.com/s/files/1/0461/8276/0601/files/9013482361.pdf
Embedded domains
- gettraff.ru
- cdn-cms.f-static.net
- uploads.strikinglycdn.com
- cdn.shopify.com
- www.w3.org
- purl.org
- ns.adobe.com
Latest analyzed threats · ATT&CK coverage
Analyzed on MalwareAnalyzer by Cyble · Open interactive report